Posted inDevelopment

Automating Dependencies with Renovate: Don’t Let Manual Updates Slow You Down

Development tutorial - IT technology blog
Development tutorial - IT technology blog

Activate Renovate Bot on GitHub in Just 5 Minutes

To get started with Renovate, you don’t need to set up a server or maintain complex infrastructure. The fastest way is to use the official GitHub App. Just three simple steps and the bot will start working immediately:

  1. Visit the GitHub Marketplace – Renovate.
  2. Click Install and select the repositories you want the bot to scan.
  3. Wait a few minutes, and Renovate will send a Configure Renovate PR. This PR contains the renovate.json configuration file. Simply merge it into your main branch, and you’re done.

Once activated, the bot will automatically scan files like package.json, go.mod, requirements.txt, or Dockerfile. If it detects outdated libraries, it will automatically create a Pull Request (PR) to upgrade them for you.

Why I Chose Renovate Over Dependabot

In the past, when managing a Node.js project with over 200 dependencies, running npm audit would often overwhelm me with a long list of security vulnerabilities. I initially used Dependabot, but it had a fatal flaw: it created too many individual PRs. Waking up to 20 email notifications for 20 tiny libraries was enough to make anyone feel discouraged.

Renovate solves the problems that Dependabot leaves behind:

  • Smart Grouping: You can group all ESLint updates or the entire React library suite into a single PR for easier review.
  • Scheduling: Instead of being spammed all week, you can configure the bot to only create PRs on Monday mornings.
  • Automerge: For minor patches (patch/minor) that pass all unit tests, the bot can automatically merge them without requiring manual intervention.

Experience shows that with a codebase of over 50,000 lines, manual updates are nearly impossible. Without automation, your project will soon become a “museum” of outdated technology.

A Production-Ready renovate.json Configuration

The renovate.json file located in the root directory is the heart of the system. Here is a configuration I typically apply to production projects to balance convenience and safety:

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:recommended",
    ":separateMajorReleases",
    ":combinePatchMinorReleases"
  ],
  "timezone": "Asia/Ho_Chi_Minh",
  "schedule": ["before 8am on monday"],
  "packageRules": [
    {
      "matchPackageNames": ["react", "react-dom"],
      "groupName": "React ecosystem"
    },
    {
      "matchUpdateTypes": ["minor", "patch"],
      "automerge": true
    }
  ]
}

Decoding Key Parameters:

  • extends: Leverages standard rule sets. config:recommended helps you avoid manual configuration from scratch.
  • schedule: I set the bot to run before 8:00 AM on Mondays. This way, when you start work at the beginning of the week, you just need to check the PRs that are already waiting.
  • packageRules: Where you can perform deep customization. The example above groups react and react-dom together to avoid version mismatches between related packages.
  • automerge: This feature is incredibly valuable. If the CI (GitHub Actions/GitLab CI) turns green, the bot automatically merges the PR, saving significant time.

Handling “Special” Dependencies Using Regex

Versions aren’t always located in standard files like package.json. Sometimes you store tool versions in a Makefile or custom text files.

Renovate can handle them all via regexManagers. Here is how I update a Node.js version defined in a Dockerfile via an environment variable:

{
  "regexManagers": [
    {
      "fileMatch": ["^Dockerfile$"],
      "matchStrings": ["ENV NODE_VERSION=(?<currentValue>.*)\\s"],
      "depNameTemplate": "node",
      "datasourceTemplate": "node"
    }
  ]
}

Battle-Tested Tips to Avoid PR Overload

Using a bot is great, but if not controlled properly, it can create noise for the team. Here are the three golden rules I’ve learned:

1. Never Automerge Major Versions

Major updates often come with breaking changes. Let the bot create the PR, then read the changelog and test thoroughly in your local environment. Renovate is very helpful by including Release Notes links directly in the PR description for easy tracking.

2. Leverage the Dependency Dashboard

Renovate automatically creates an Issue called the “Dependency Dashboard.” This is a control center that gives you an overview of which PRs are pending, which ones have errors, or allows you to request the bot to retry updating a failed library by simply checking a box.

3. Group Dev Dependencies to Reduce Noise

Projects often have many dev dependencies like linters, Prettier, or test runners. You don’t want to receive 5-10 notifications just to upgrade eslint-plugin. Group them into a single unit:

{
  "packageRules": [
    {
      "matchDepTypes": ["devDependencies"],
      "groupName": "All dev dependencies",
      "automerge": true
    }
  ]
}

Conclusion

Managing dependencies is like cleaning your house. Doing a little bit every day is easy, but letting it pile up for a year is a disaster.

In the teams I’ve worked with, after implementing Renovate, library maintenance time dropped from 4 hours per week to less than 15 minutes. Most importantly, security vulnerabilities (CVEs) are patched almost instantly. Try setting it up today to protect your project!

Share:
Tags: